-1

Most binaries have jump and control flow instructions that are relative to other locations in the binary. For example: if I modify an instruction around 0x12341232, and there is an instruction somewhere in the code that would do jmp 0x12341234, that 0x12341234 location will not be the same.

So,

# Original
0x12341232:  mov eax, ebx
0x12341234:  call sym.hello
...

0x13371337:  jmp 0x12341234 # points to correct instruction

--------

# Modified
0x12341232:  call 0x3232
0x12341237:  call sym.hello
...

0x13371337:  jmp 0x12341234 # points to incorrect instruction

AFAIK, ARM's ISA would have a lot less trouble handling this issue since it has fixed-length instructions. x86 would have a big issue with this.

My question is: Is there a framework or research paper that tackles this issue?

Many thanks

Improve this question
4
  • Nobody will allow you to modify running code. What do you actually want to achieve?
    – gnasher729
    Jan 26, 2020 at 12:49
  • Hey! 1. I'm trying to modify a binary on-disk, not in memory for purposes of simplifying a compiled binary by replacing patterns with simplified ones. 2. I think it is possible to modify memory pages and the mapped process sections if you own a piece of the process.
    – Solidak
    Jan 26, 2020 at 19:59
  • FYI, would be cool to know why the downvotes... I can rephrase the question better...
    – Solidak
    Jan 26, 2020 at 19:59
  • The best way is to get the source code, make your modification, and recompile it. Changing code after it's been compiled is usually nontrivial.
    – CJ Dennis
    Jan 27, 2020 at 8:09

1 Answer 1

Reset to default
0

Easiest would be to conserve all addresses, not shifting code around.

  • If the replacing patch is in equal size there is no problem.

  • If the patch is smaller you can padd with no-ops, no-operations.

  • If the patch is larger, you can add the patch at the end, and insert a jump to it, with at the end of the patch a jump back.

In reality there are relative and absolute, short and long jumps. Shifting code around would also take into account the data segments, not to taken as code.

As a binary is the result of linking object files, the code is not that spaghetti like w.r.t. jump/call addresses, but the effort is too large IMHO.

The research you wanted: maybe rather look into disassemblers, which might provide generating labels, hence immediately assemblable.

Improve this answer
1
  • Thank you, Mr. Eggen! The idea I had was to have a scanner for all conditional control flows which would work before and after a patch and account for the differences. I do really like the idea of a jump table (point three you mentioned). Many thanks again
    – Solidak
    Jan 28, 2020 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.